Overview

overview

10

Static

static

1

a15f053b71...4d.exe

windows11-21h2-x64

10

Resubmissions

22-05-2024 14:51

240522-r8f9xsfa6s 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a15f053b71cda0497efdec08b4680267b936024d.exe

  • Size

    6.6MB

  • Sample

    240522-r8f9xsfa6s

  • MD5

    064d9b8a16b733266a651332c622a54e

  • SHA1

    a15f053b71cda0497efdec08b4680267b936024d

  • SHA256

    8e723f79d696edac7fa9da08d07dd796b4fa6f56886a2f10ea66e618bf0273f1

  • SHA512

    18cee323ab07689c6e030d647f0296ec97a12af860fce2252d72d11f3f54c69aca266329fa58cf08213417fd0de54dfab7477a3d9923e83812470fa1b8c79110

  • SSDEEP

    98304:OHiCrTw8ZnKEkrssgY6B++D0VH5Z1UqoVoMvoH:Qr615rieH

Score
10/10
sectopratratspywaretrojan

Malware Config

Targets

    • Target

      a15f053b71cda0497efdec08b4680267b936024d.exe

    • Size

      6.6MB

    • MD5

      064d9b8a16b733266a651332c622a54e

    • SHA1

      a15f053b71cda0497efdec08b4680267b936024d

    • SHA256

      8e723f79d696edac7fa9da08d07dd796b4fa6f56886a2f10ea66e618bf0273f1

    • SHA512

      18cee323ab07689c6e030d647f0296ec97a12af860fce2252d72d11f3f54c69aca266329fa58cf08213417fd0de54dfab7477a3d9923e83812470fa1b8c79110

    • SSDEEP

      98304:OHiCrTw8ZnKEkrssgY6B++D0VH5Z1UqoVoMvoH:Qr615rieH

    Score
    10/10
    sectopratratspywaretrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Executes dropped EXE

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks